Disk space allocation policy
For FortiAnalyzer 5.2 and earlier, disk space is allocated per device. Starting in FortiAnalyzer 5.4, disk space can be allocated per ADOM. Following is the policy governing disk space allocation when FortiAnalyzer is upgraded from 5.2 to 5.4.0 and later.
Normal ADOM mode
For FortiAnalyzer working in the Normal ADOM mode, after upgrading to 5.4.0 and later, the ADOM for each managed device (with or without VDOMs) is allocated the disk space of the device before upgrade plus 10%.
For example, a FortiGate device allotted 30GB in 5.2 gets 33GB (30GB + 10%) to the ADOM of this FortiGate device after the upgrade to FortiAnalyzer 5.4.0 and later.
Advanced ADOM mode
For FortiAnalyzer working in the Advanced ADOM mode, after upgrading to 5.4.0 and later, the disk space of the device is split among the VDOMs of different ADOMs proportional to the log distribution across the VDOMs. Each ADOM also gets 10% extra.
For example, the disk quota for Device-A is 10GB in 5.2. Device-A consists of three VDOMs: root VDOM (the management VDOM), VDOM1, and VDOM2, which are assigned to ADOM root, ADOM1, and ADOM2 respectively.
During the upgrade, FortiAnalyzer calculates that 10% of Device-A log files are from root VDOM, 30% from VDOM1, and 60% from VDOM2. Accordingly, FortiAnalyzer assigns 1.1GB (1GB + 10%) to ADOM root, 3.3GB (3GB + 10%) to ADOM1, and 6.6GB (6GB+ 10%) to ADOM2.
Additional policies
When the content files of the device, including DLP (data leak prevention) files, antivirus quarantine files, and IPS (intrusion prevention system) packet captures, use more than 40% of its disk quota, FortiAnalyzer adds extra space to the device.
ADOM disk quota is recommended to be at least 1GB in 5.4. If the disk quota of a device is less than 1GB before upgrading to 5.4.x, the ADOM quota for the device is adjusted to 1GB after upgrading to 5.4.x.
|
This adjustment might cause the total allocated disk space to exceed the actual device disk space. Verify using the |